Mozilla: WebExtension bypass of domain restrictions through header rewriting
Published Feb 28, 2019
7.5
HIGHCVSS 3.0
EPSS 2.85%
Description
By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.
Affected products
-
- Version unspecifiedStatusaffectedConstraints<63
- Version
-
- Version unspecifiedStatusaffectedConstraints<60.3
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox | n/a |
| ||||||
| Mozilla | Firefox ESR | n/a |
|
Configuration 1
- < 63.0
- < 60.3
Configuration 2
- 8.0
- 9.0
Configuration 3
- 14.04
- 16.04
- 18.04
- 18.10
Configuration 4
- 6.0
- 7.0
- 6.0
- 7.0
- 7.5
- 6.0
- 7.0
No data.
Red Hat Enterprise Linux 6
firefox-0:60.3.0-1.el6
Fixed · RHSA-2018:3006
Red Hat Enterprise Linux 7
firefox-0:60.3.0-1.el7_5
Fixed · RHSA-2018:3005
Red Hat Enterprise Linux 6
thunderbird
Not affected
Red Hat Enterprise Linux 7
thunderbird
Not affected
Red Hat Enterprise Linux 8
firefox
Not affected
Red Hat Enterprise Linux 8
thunderbird
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | firefox-0:60.3.0-1.el6 | Fixed | RHSA-2018:3006 |
| Red Hat Enterprise Linux 7 | firefox-0:60.3.0-1.el7_5 | Fixed | RHSA-2018:3005 |
| Red Hat Enterprise Linux 6 | thunderbird | Not affected | n/a |
| Red Hat Enterprise Linux 7 | thunderbird | Not affected | n/a |
| Red Hat Enterprise Linux 8 | firefox | Not affected | n/a |
| Red Hat Enterprise Linux 8 | thunderbird | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (17)
- http://www.securityfocus.com/bid/105718 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1041944 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:3005 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3006 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2018-12395 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1467523 x_refsource_CONFIRMIssue TrackingPermissions RequiredVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1642185 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-4369 Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-12395
- https://security.gentoo.org/glsa/201811-04 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://usn.ubuntu.com/3801-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-12395
- https://www.debian.org/security/2018/dsa-4324 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12395
- https://www.mozilla.org/security/advisories/mfsa2018-26/ x_refsource_CONFIRMVendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-27/ x_refsource_CONFIRMVendor Advisory
Change history (0)
No recorded changes yet.